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1 INTRODUCTION 


The mission of the European Data Protection Board (EDPB) is to ensure the consistent application of 
European data protection rules and to promote effective cooperation among supervisory authorities 
throughout the European Economic Area (EEA). 


On 25 May 2018, the EDPB began putting into practice a new institutional and legal framework. This 
framework comprises both the General Data Protection Regulation’ (GDPR) and the Law Enforcement 








Directive? (LED). Under the GDPR and LED, cooperation is no longer an option or an ancillary task, but 
a core and integral part of our work. While much has been achieved, we must address a series of 
challenges in order to enhance the protection of personal data within and beyond our borders. To be 
effective in confronting the main challenges ahead, the EDPB has decided to define a strategy for 2021- 
2023. 


Our ultimate goal of protecting individuals with regard to the processing of personal data continues to 
drive our actions. The development of a common data protection culture, which serves as an 
inspiration and model globally, is at the core of our strategy. 


This Strategy does not provide an exhaustive overview of the work of the EDPB in the years to come. 
Rather it sets out the four main pillars of our strategic objectives, as well as set of key actions to help 
achieve those objectives. The EDPB will implement this Strategy within its Work Program, and will 
report on the progress achieved in relation to each Pillar as part of its annual reports. 


2 PILLAR 1: ADVANCING HARMONISATION AND FACILITATING 
COMPLIANCE 


The EDPB will continue to strive for a maximum degree of consistency in the application of data 
protection rules and limit fragmentation among Member States. In addition to providing practical, 
easily understandable and accessible guidance, the EDPB will develop and promote tools that help to 
implement data protection into practice, taking into account practical experiences of different 
stakeholders on the ground. 


> Key action 1: the EDPB will focus on providing further guidance on key notions of EU data 
protection law (e.g., on the concept of legitimate interest, on the scope of data subjects’ rights) 
which are essential to its consistent application. Through the organisation of dedicated 
stakeholder events and public consultations, we will continue to engage with a wide range of 
external stakeholders (large companies and SMEs, NGOs, DPOs networks and other data 


1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of 
natural persons with regard to the processing of personal data and on the free movement of such data, and 
repealing Directive 95/46/EC (General Data Protection Regulation). 

2 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of 
natural persons with regard to the processing of personal data by competent authorities for the purposes of the 
prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, 
and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA. 
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protection professionals) in order to ensure practical relevance. Additional efforts will go to make 
a more proactive use of the consistency mechanism as well as of other tools in order to address 
potential gaps or divergences in interpretation and practices in Member States. 


> Key action 2: the EDPB will further promote development and implementation of compliance 
mechanisms for controllers and processors: increased efforts and resources will be invested — in 
particular through dedicated workshops and staff trainings - to stimulate the development of tools 
to promote compliance, in particular codes of conduct and certifications. 


> Key action 3: the EDPB will foster the development of common tools for a wider audience and 
engage in awareness raising and outreach activities: the EDPB already issues guidelines and 
opinions addressed to professionals with extensive expert knowledge. Building on the resources 
already available at national level, the Board will develop tools specifically tailored for non-expert 
professionals, such as SMEs, and for data subjects, in particular children. 


3 PILLAR 2: SUPPORTING EFFECTIVE ENFORCEMENT AND EFFICIENT 
COOPERATION BETWEEN NATIONAL SUPERVISORY AUTHORITIES 


The EDPB is fully committed to support cooperation between all national supervisory authorities that 
work together to enforce European data protection law. We will streamline internal processes, 
combine expertise and promote enhanced coordination. We intend not only to ensure a more efficient 
functioning of the cooperation and consistency mechanisms, but also to strive for the development of 
a genuine EU-wide enforcement culture among supervisory authorities. 


> Key action 1: encourage and facilitate use of the full range of cooperation tools enshrined in 
Chapter VII of the GDPR and Chapter VII of the LED, bridge gaps or differences between 
national enforcement procedures, and continuously evaluate and improve the efficiency and 
effectiveness of these tools. Further promoting a common application of key concepts in the 
cooperation procedure and strengthening of the communication between SAs. 


> Key action 2: implement a Coordinated Enforcement Framework (CEF) to facilitate joint 
actions in a flexible but coordinated manner, ranging from joint awareness raising and 
information gathering to enforcement sweeps and joint investigations. The CEF will facilitate 
the coordination of enforcement actions driven by commonly identified priorities and using 
common methodologies. 


> Key action 3: establish a Support Pool of Experts (SPE) on the basis of a pilot project, with a 
view of providing material support in the form of expertise that is useful for investigations and 
enforcement activities of significant common interest and to enhance the cooperation and 
solidarity between all SAs by reinforcing and complementing the strengths of the individual 
SAs and addressing operational needs. 
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4 PILLAR 3: A FUNDAMENTAL RIGHTS APPROACH TO NEW 
TECHNOLOGIES 


The protection of personal data helps to ensure that technology, new business models and society 
develop in accordance with our values, such as human dignity, autonomy and liberty. The EDPB will 
continuously monitor new and emerging technologies and their potential impact on the fundamental 
rights and daily lives of individuals. Data protection should work for all people, particularly in the face 
of processing activities presenting the greatest risks to individuals’ rights and freedoms (e.g. to prevent 
discrimination). We will help to shape Europe’s digital future in line with our common values and rules. 
We will continue to work with other regulators and policymakers to promote regulatory coherence 
and enhanced protection for individuals. 


> Key Action 1: Assessing new technologies: proactively monitoring, assessing and establishing 
common positions and guidance as regards new technological applications in areas such as 
artificial intelligence (Al), biometrics, profiling, ad tech and continuous evaluation of existing 
positions on applications such as cloud services, blockchain etc. 


> Key Action 2: Reinforcing data protection by design and by default and accountability: 
provide clear guidance on how to implement data protection principles effectively, what 
individuals are entitled to expect and what organisations can do to further improve the ability 
of individuals to exercise control over their personal data and demonstrate compliance with 
their obligations. 


> Key Action 3: intensify engagement and cooperation with other regulators (e.g. consumer 
protection and competition authorities) and policymakers to ensure that individuals receive 
optimal protection and to prevent harms from occurring, including where necessary or 
appropriate in the context of open consultations on new draft proposals or new projects. 


5 PILLAR 4: THE GLOBAL DIMENSION 


The EDPB is determined to set and promote high EU and global standards for international data 
transfers to third countries in the private and the public sector, including in the law enforcement 
sector. We will reinforce our engagement with the international community to promote EU data 
protection as a global model and to ensure effective protection of personal data beyond EU borders. 


> Key Action 1: Promote the use of transfer tools ensuring an essentially equivalent level of 
protection and increase awareness on their practical implementation: develop and provide 
further practical guidance on how these transfer tools — especially new ones - can maintain a 
high level of protection of personal data transferred from the EEA to third countries, taking 
into account the risks linked to access to personal data by the public authorities of third 
countries and the need to ensure enforceable rights, effective redress and safeguards 
concerning onward transfers. 


> Key Action 2: Engaging with the international community: the EDPB and its members will 
strive to engage in dialogue with international organisations and institutional networks in 
order to provide leadership in data protection and promote high standards of protection 
worldwide. 
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> Key Action 3: facilitate the engagement between EDPB members and the supervisory 
authorities of third countries with a focus on cooperation in enforcement cases involving 
controllers/processors located outside the EEA. 


For the European Data Protection Board 
The Chair 


(Andrea Jelinek) 
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